USB Removable Media Exfiltration via File Copy or xcopy/robocopy

Ankit Mehta@Secvyn

•updated Jun 30, 2026•4•0•3

Detects high-volume file writes or the use of common command-line copy utilities (xcopy, robocopy, copy) targeting removable drive paths (E-G:). This behavior is often indicative of data staging or exfiltration activities.